37.4  Prevention of unlawful processing

The Service Provider shall bring into effect and maintain all technical and organisational measures to prevent unauthorised or unlawful processing of Personal Data and accidental loss or destruction of, or damage to, Personal Data including but not limited to take reasonable steps to ensure the reliability of staff having access to the Personal Data.